Hacking Tools rekall

Published on April 21st, 2015 | 7,092 views Post Views

Rekall – The Most Complete Memory Analysis Framework

The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The Rekall distribution is available from: http://www.rekall-forensic.com/

Rekall should run on any platform that supports Python (http://www.python.org)
Rekall supports investigations of the following x86 bit memory images:
  • Microsoft Windows XP Service Pack 2 and 3
  • Microsoft Windows 7 Service Pack 0 and 1
  • Linux Kernels 2.6.24 to 3.10.
  • OSX 10.6-10.8.
Rekall also provides a complete memory sample acquisition capability for all major operating systems (see the tools directory).
Quick start

Rekall is available as a python package installable via the pip package manager. Simply type (for example on Linux):
sudo pip install rekall
You might need to specifically allow pre-release software to be included (until Rekall makes a major stable release):
sudo pip install --pre rekall
To have all the dependencies installed. You still need to have python and pip installed first.
To be able to run the ipython notebook, the following are also required:
pip install Jinja2 MarkupSafe Pygments astroid pyzmq tornado wsgiref
For windows, Rekall is also available as a self contained installer package. Please check the download page for the most appropriate installer to use.


Development version

For development it is easier to install rekall inside a virtual env. Virtual Env is a way for containing and running multiple versions of python packages at the same time, without interfering with the host system.
# You might need to install virtualenv:
$ sudo apt-get install python-virtualenv

# This will build a new empty python environment.
$ virtualenv /tmp/Test

# Now we switch to the environment - all python code runs from here.
$ source /tmp/Test/bin/activate

# This will install all dependencied into the virtual environment.
$ pip install --pre rekall

# For development run the devel version
$ git clone https://github.com/google/rekall.git
$ cd rekall
$ python setup.py develop
When done you can just remove the /tmp/Test directory.

Share on Facebook0Share on Google+0Tweet about this on TwitterShare on Reddit0Email this to someonePrint this pageShare on StumbleUpon0Digg thisPin on Pinterest0Share on LinkedIn1

One Response to Rekall – The Most Complete Memory Analysis Framework

  1. Well written!! Thanks for sharing the great information.

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to Top ↑

You Might Also Like:
Bacula – Network Backup Tool for Linux, Unix, Mac, and Windows

Bacula is a set of computer programs that permits the system administrator to manage backup, recovery, and verification of computer...